149 lines
7.9 KiB
Markdown
149 lines
7.9 KiB
Markdown
# Troubleshoot barong authorization process and envoy routing
|
|
|
|
## Architecture overview
|
|
|
|
Before establishing a connection to a microservice (for example ***rango***) envoy verifies the authorization by sending a request to ***barong authz***. Barong authz verifies the cookie (when using the UI) and the HMAC signature (when using API) and returns a signed token (JWT) if everything is valid.
|
|
|
|
|
|
|
|
|
|
## Enable envoy debug logs
|
|
|
|
To troubleshoot connection problems with a microservice of the stack, you can enable envoy logs to understand in which step the connection problem appears.
|
|
|
|
To do so you need to:
|
|
|
|
1. Edit *templates/compose/gateway.yaml.erb*
|
|
|
|
2. Change *info* by *debug* in the following lines:
|
|
|
|
```yaml
|
|
command: /usr/local/bin/envoy -l debug -c /etc/envoy/envoy.yaml
|
|
```
|
|
|
|
3. Render the configuration files
|
|
|
|
```bash
|
|
rake render:config
|
|
```
|
|
|
|
4. Restart envoy
|
|
|
|
```bash
|
|
docker-compose up -dV gateway
|
|
```
|
|
|
|
5. Finally you can inspect the envoy logs
|
|
|
|
```bash
|
|
docker-compose logs -f --tail 100 gateway
|
|
```
|
|
|
|
Here are the relevant logs:
|
|
|
|
1. Initial websocket connection
|
|
```log
|
|
gateway_1 | [2020-12-02 07:50:30.169][13][debug][http] [source/common/http/conn_manager_impl.cc:580] [C184][S12609685784760114286] request headers complete (end_stream=false):
|
|
gateway_1 | ':authority', 'www.app.local'
|
|
gateway_1 | ':path', '/api/v2/ranger/private/?stream=global.tickers'
|
|
gateway_1 | ':method', 'GET'
|
|
gateway_1 | 'user-agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36'
|
|
gateway_1 | 'accept-encoding', 'gzip, deflate'
|
|
gateway_1 | 'accept-language', 'en-US,en;q=0.9,fr;q=0.8'
|
|
gateway_1 | 'cache-control', 'no-cache'
|
|
gateway_1 | 'connection', 'Upgrade'
|
|
gateway_1 | 'cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46'
|
|
gateway_1 | 'origin', 'http://www.app.local'
|
|
gateway_1 | 'pragma', 'no-cache'
|
|
gateway_1 | 'sec-websocket-key', 'b16LunIyXls4CtNZ1lYWsw=='
|
|
gateway_1 | 'sec-websocket-extensions', 'permessage-deflate; client_max_window_bits'
|
|
gateway_1 | 'sec-websocket-version', '13'
|
|
gateway_1 | 'upgrade', 'websocket'
|
|
gateway_1 | 'x-forwarded-for', '172.20.0.1'
|
|
gateway_1 | 'x-forwarded-host', 'www.app.local'
|
|
gateway_1 | 'x-forwarded-port', '80'
|
|
gateway_1 | 'x-forwarded-proto', 'ws'
|
|
gateway_1 | 'x-forwarded-server', '41e065adb32e'
|
|
gateway_1 | 'x-real-ip', '172.20.0.1'
|
|
```
|
|
|
|
2. Request to Barong authz
|
|
```log
|
|
gateway_1 | [2020-12-02 07:50:30.183][13][debug][router] [source/common/router/router.cc:320] [C0][S3254558628791445120] cluster 'barong' match for URL '/api/v2/auth/api/v2/ranger/private/?stream=global.tickers'
|
|
gateway_1 | [2020-12-02 07:50:30.184][13][debug][router] [source/common/router/router.cc:381] [C0][S3254558628791445120] router decoding headers:
|
|
gateway_1 | ':method', 'GET'
|
|
gateway_1 | ':path', '/api/v2/auth/api/v2/ranger/private/?stream=global.tickers'
|
|
gateway_1 | ':authority', 'www.app.local'
|
|
gateway_1 | ':scheme', 'http'
|
|
gateway_1 | 'content-length', '0'
|
|
gateway_1 | 'x-forwarded-for', '172.20.0.1,172.20.0.8'
|
|
gateway_1 | 'cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46'
|
|
gateway_1 | 'user-agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36'
|
|
gateway_1 | 'x-forwarded-host', 'www.app.local'
|
|
gateway_1 | 'x-forwarded-proto', 'ws'
|
|
gateway_1 | 'x-envoy-internal', 'true'
|
|
gateway_1 | 'x-envoy-expected-rq-timeout-ms', '1000'
|
|
```
|
|
|
|
3. Routing the connection to rango
|
|
|
|
```log
|
|
gateway_1 | [2020-12-02 07:50:30.220][13][debug][filter] [source/extensions/filters/http/ext_authz/ext_authz.cc:175] [C186][S2592169017517480399] ext_authz filter accepted the request
|
|
gateway_1 | [2020-12-02 07:50:30.220][13][debug][router] [source/common/router/router.cc:320] [C186][S2592169017517480399] cluster 'rango' match for URL '/api/v2/ranger/private/?stream=global.tickers'
|
|
gateway_1 | [2020-12-02 07:50:30.220][13][debug][router] [source/common/router/router.cc:381] [C186][S2592169017517480399] router decoding headers:
|
|
gateway_1 | ':authority', 'www.app.local'
|
|
gateway_1 | ':path', '/api/v2/ranger/private/?stream=global.tickers'
|
|
gateway_1 | ':method', 'GET'
|
|
gateway_1 | ':scheme', 'http'
|
|
gateway_1 | 'user-agent', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36'
|
|
gateway_1 | 'accept-encoding', 'gzip, deflate'
|
|
gateway_1 | 'accept-language', 'en-US,en;q=0.9,fr;q=0.8'
|
|
gateway_1 | 'cache-control', 'no-cache'
|
|
gateway_1 | 'connection', 'Upgrade'
|
|
gateway_1 | 'cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46'
|
|
gateway_1 | 'origin', 'http://www.app.local'
|
|
gateway_1 | 'pragma', 'no-cache'
|
|
gateway_1 | 'sec-websocket-key', 'tocGzAPK8TACk8zzRX7n3g=='
|
|
gateway_1 | 'sec-websocket-extensions', 'permessage-deflate; client_max_window_bits'
|
|
gateway_1 | 'sec-websocket-version', '13'
|
|
gateway_1 | 'upgrade', 'websocket'
|
|
gateway_1 | 'x-forwarded-for', '172.20.0.1'
|
|
gateway_1 | 'x-forwarded-host', 'www.app.local'
|
|
gateway_1 | 'x-forwarded-port', '80'
|
|
gateway_1 | 'x-forwarded-proto', 'ws'
|
|
gateway_1 | 'x-forwarded-server', '41e065adb32e'
|
|
gateway_1 | 'x-real-ip', '172.20.0.1'
|
|
gateway_1 | 'content-length', '0'
|
|
gateway_1 | 'x-envoy-internal', 'true'
|
|
gateway_1 | 'x-request-id', '5b87e64a-4155-498e-916c-b8b998725a71'
|
|
gateway_1 | 'x-envoy-expected-rq-timeout-ms', '15000'
|
|
gateway_1 | ':status', '200'
|
|
gateway_1 | 'authorization', 'Bearer eyJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE2MDY4OTU0MzAsImV4cCI6MTYwNjg5OTAzMCwic3ViIjoic2Vzc2lvbiIsImlzcyI6ImJhcm9uZyIsImF1ZCI6WyJwZWF0aW8iLCJiYXJvbmciXSwianRpIjoiNTllNGIwNTA3YTgyMGNjMzYzMTIiLCJ1aWQiOiJJRDVGRkE5OERDMjciLCJlbWFpbCI6ImFkbWluQGJhcm9uZy5pbyIsInJvbGUiOiJhZG1pbiIsImxldmVsIjozLCJzdGF0ZSI6ImFjdGl2ZSIsInJlZmVycmFsX2lkIjpudWxsfQ.Br6-yujI5MgU_BktVDYNaEPNtHOMxQZbNS89deQfxNiPPkx6B8ZUDXL9og5DQ6nWBExlHydyPPcCSUvO5BCth_UWiuttY_ldy7TIr_JrXT0td8WN8fq8QadOWFuJ7wvMEklRGVKQmvOrooHNKz_WwcY4xmaSO3SVgQdFSkmt626MOXmo9Wa3nYsL6EafCMe--9PHWop4L-B1w5ndvbGuGLbJaqEktXsudOX0A9Js2sKuHPxSe8QJKN5XwmOFPAWM28-VkaU5cmshMK2CwJaSRhVoL0gIi9VUGpFVVJ1ciD0VHjRfxuFTzph7utRuO_M9N-bweLL8YCCA8RkwlVyuLg'
|
|
gateway_1 | 'content-type', 'text/html; charset=utf-8'
|
|
gateway_1 | 'cache-control', 'no-cache'
|
|
gateway_1 | 'set-cookie', '_barong_session=4cff598ee40d3d2ec38875ddc904fc46; path=/; expires=Thu, 03 Dec 2020 07:50:30 GMT; HttpOnly'
|
|
gateway_1 | 'x-request-id', '8ff80928-9091-40b0-b6f0-c0b46f8d72fe'
|
|
gateway_1 | 'x-runtime', '0.031033'
|
|
gateway_1 | 'vary', 'Origin'
|
|
gateway_1 | 'transfer-encoding', 'chunked'
|
|
gateway_1 | 'x-envoy-upstream-service-time', '37'
|
|
```
|
|
|
|
|
|
## Authz configuration
|
|
|
|
In case of authorization problem check the following configuration files:
|
|
|
|
1. *config/barong/authz_rules.yml*
|
|
This file contains the default public endpoints and blocked endpoints.
|
|
If you have a problem accessing a public endpoint make sure the URL is present in the *rules.pass* section.
|
|
|
|
2. *templates/config/barong/seeds.yml.erb*
|
|
Check the *permissions* section to make sure the role of the user is allowed to access the resource.
|
|
|
|
Run the following command to apply the changes:
|
|
|
|
```bash
|
|
rake service:setup
|
|
```
|